ntopng

Overview

ntopng is a self-hosted network traffic probe for administrators who need visibility across traffic sources and protocols. It suits home and small-network practitioners as well as enterprises that can match an edition to their scale. Its breadth is a strength, but interface caps and paid-edition features make the right plan important.

The probe gathers information from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems. It presents real-time and historical traffic exploration through an encrypted web interface. The project began in 1998 with the aim of building web-based traffic monitoring.

For readers comparing Network Traffic Analysis Software, ntopng emphasizes traffic collection, protocol identification, and performance measures; it also belongs in Bandwidth Monitoring Software and broader Network Monitoring comparisons.

Key features

Traffic collection and protocol visibility

ntopng captures packets through libpcap or PF_RING and collects flows from nProbe, NetFlow, and sFlow exporters. Its nDPI-powered detection recognizes more than 450 Layer-7 application protocols, helping administrators identify application activity rather than relying on undifferentiated traffic totals. That combination is useful when a network has multiple collection sources, though the product's scale is still bounded by the chosen edition's suggested host and flow counts.

Performance and extensibility

Metrics include application latency, round-trip time, throughput, TCP retransmissions, packet loss, and VoIP jitter and MOS. These give network operators several ways to investigate service quality alongside traffic volume. An HTTP-based RESTful API and Lua scriptability support integration or customization, while export to Elasticsearch and big-data systems extends its data use.

LDAP and OpenID Connect login, multiple-interface aggregation, and alert delivery to Elasticsearch, Microsoft Teams, or Fail2Ban are assigned to Pro and higher editions. Those are meaningful boundaries for organizations that need centralized identity, combined interface views, or those alert destinations. ntop says packages are PGP-signed so users can verify integrity; its security contact promises a non-automated acknowledgment within three working days. Community support is best-efforts, while paid options include phone, email, or on-site support, consultancy, training, and customization.

Pricing

The Community (Open Source) plan costs nothing. It is aimed at home and network practitioners, with a suggested maximum of 256 live local hosts and 128K live flows, and a maximum of 8 monitored interfaces. That makes it a practical starting point for smaller networks, but not a fit when those caps or paid-edition features are insufficient.

Pro costs €299, paid once as a perpetual license and includes one year of maintenance. It targets offices and small enterprises, with suggested maxima of 256 live local hosts and 1M live flows and up to 8 monitored interfaces. Enterprise M costs €699.95, paid once, Enterprise L €899.95, paid once, and Enterprise XL €1,499.95, paid once; each is a perpetual license with one year of maintenance. Their respective suggested host and flow maxima are 1K and 4M, 4K and 8M, and 32K and 16M, with interface limits of 16, 32, and 64.

The Enterprise editions suit progressively larger networks that need more capacity than Pro allows. Licenses are perpetual and include installation support, one year of maintenance, updates, and support for the maintenance period. Buyers should account for the maintenance term rather than assume ongoing updates and support beyond that year.

Platforms

ntopng supports Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; its product page also names pfSense and OPNsense among supported Unix platforms. The product is self-hosted, with a web interface and API, so it is intended for operators managing their own deployment rather than those seeking a hosted service. The platform range is broad, but the listed deployment options do not include mobile platforms.

Who it's for

Choose ntopng if you need a self-hosted view across packet and flow sources, detailed Layer-7 identification, and performance metrics in one traffic probe. The free edition is best suited to small networks within its 8-interface, 256-host, and 128K-flow recommendations. Pro is a natural step for small offices that need more flow capacity or its paid features; Enterprise tiers are for organizations needing higher suggested host, flow, and interface limits. It is less suitable if you need more than 64 monitored interfaces or want a managed service.

Pros and cons

• Broad collection options: It takes traffic from mirrors, flow exporters, SNMP devices, firewall logs, and intrusion detection systems, which helps when visibility depends on several sources.
• Detailed diagnostics: More than 450 detected application protocols and metrics spanning latency, retransmissions, packet loss, and VoIP quality support investigation beyond basic traffic volume.
• Usable free tier: Community costs nothing and supports up to 8 interfaces, but its suggested live-flow ceiling is 128K.
• Paid features and capacity have clear costs: Pro starts at €299, paid once, and multiple-interface aggregation and selected alert integrations require Pro or higher; larger interface counts require Enterprise plans.
• Support varies by route: Community support is best-efforts, while commercial-grade support and related services are paid options.

Alternatives

ManageEngine NetFlow Analyzer is worth considering if a freemium tool with Android and iOS support or a monthly subscription is a better fit; its free edition covers 2 interfaces, while Standard is $172 a month for 10 interfaces.

Caligare Flow Inspector may suit non-commercial use with a narrowly capped free edition: it allows 2 devices, 24-hour history, and up to 250 flows per second, and also offers a free trial.

Nagios XI is an option for readers seeking a node- or service-counted monitoring plan, including a free tier capped at 7 nodes or 100 services, whichever comes first.

Akvorado is another free, self-hosted option for Linux or macOS deployments.

ElastiFlow may appeal if its free Basic plan's 4,000 records-per-second ceiling, 25 SNMP devices, dashboards, ML detections, and Slack plus forum support align with your needs.

Riverbed Aternity is an enterprise offering with custom pricing for readers considering a paid enterprise product.

pmacct is a free, Linux-based self-hosted alternative.

Intermapper is another freemium choice available for Windows, macOS, Linux, and web.

Verdict

ntopng is a strong choice for administrators who want broad, self-hosted traffic collection paired with unusually wide protocol coverage and useful performance metrics. Its free edition gives smaller networks a credible entry point, while perpetual paid tiers raise flow, host, and interface capacity. Look elsewhere if you need a hosted service, exceed the Enterprise XL interface limit, or require paid-edition features without moving beyond Community.